Three decision states
Allowed means permitted without a whitelist match. Blocked identifies a block-list or policy rejection. Whitelisted means explicitly allowed by a whitelist. The Allowed filter does not include Whitelisted rows.
Narrow the search
Filter by domain, client IP or PTR hostname, DNS server, policy target, matched list, decision, and time range. Domain, client, and list text filters support Contains, Starts with, and Exact; percent and underscore characters are literal.
Follow the reason
Inspect the server ID, client, protocol, question type, response time, target, matched list, and reason. Compare an unexpected result in Policy Tester. Hostnames may arrive after background PTR resolution.
Browse stable results
Page navigation pins a query-ID snapshot so incoming traffic does not shift rows between pages. Auto refresh pauses while browsing it; choose Latest results to resume live activity. Time boundaries use the timezone shown beside the fields, not the browser timezone.